Active Connections Not Showing

[VoxelMints]

I use this command "watch -d -n1 lsof -i" to see active connections to my pc I have one problem with this, it doesn't show which connections are made when I'm using the Update Manager and I'm concerned about this. I wonder if I might be missing other connections made to my computer because I'm not aware of how to properly monitor them.

I felt the above lsof command worked great and it showed the process name first which is very useful.

Being that I came from "dat other os" I'm missing tools that were available there like tcpview.

Are there other ways to monitor active connections?

[Pippin]

Yes there are.
Take a look at command line utility tcpdump or one with a GUI, Wireshark.

Another from the command line you could also do:

Code: Select all

watch -d -n 1 netstat -atunp

[VoxelMints]

I appreciate the info and your patience for my unfamiliarity with Mint. If I understand correctly I would need to be root to see connections from the update manager? Can Netstat show Https or Http?

[Pippin]

When looking at the destination port, yes it can unless you have something else connecting to the same destination port, like in this example:

Code: Select all

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.1.1:53            0.0.0.0:*               LISTEN      2256/dnsmasq    
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      927/cupsd       
tcp        0      0 192.168.168.2:42654     192.124.249.8:443       ESTABLISHED 8647/firefox    
tcp        0      0 192.168.42.134:59278    xx.xxx.xx.xxx:443       ESTABLISHED 2346/openvpn    
tcp        0      0 192.168.168.2:48512     192.124.249.9:443       ESTABLISHED 8647/firefox    
tcp        0      0 192.168.168.2:39878     195.181.160.222:443     TIME_WAIT   -               
tcp        0      0 192.168.168.2:58886     151.101.36.193:443      ESTABLISHED 8647/firefox    
tcp        0      0 192.168.168.2:45206     216.58.212.202:443      ESTABLISHED 8647/firefox    
tcp        0      0 192.168.168.2:45110     216.58.212.202:443      TIME_WAIT   -               
tcp        0      0 192.168.168.2:53560     208.123.73.199:443      ESTABLISHED 8647/firefox    
udp     9984      0 127.0.1.1:53            0.0.0.0:*                           2256/dnsmasq    
udp     8064      0 0.0.0.0:68              0.0.0.0:*                           2240/dhclient   
udp        0      0 0.0.0.0:41049           0.0.0.0:*                           945/avahi-daemon: r
udp        0      0 192.168.168.2:123       0.0.0.0:*                           2725/ntpd       
udp        0      0 192.168.42.134:123      0.0.0.0:*                           2725/ntpd       
udp        0      0 127.0.0.1:123           0.0.0.0:*                           2725/ntpd       
udp        0      0 0.0.0.0:123             0.0.0.0:*                           2725/ntpd       
udp    37632      0 0.0.0.0:35346           0.0.0.0:*                           2256/dnsmasq    
udp        0      0 0.0.0.0:631             0.0.0.0:*                           1110/cups-browsed
udp    16128      0 0.0.0.0:5353            0.0.0.0:*                           945/avahi-daemon: r

You see destination port 443 used by Firefox which is HTTPS (encrypted).
Destination port 80 would be HTTP (unencrypted).
You also see destination port 443 for OpenVPN, which is connected at the moment.
Both using TCP.

If you want to see all output from the given command, do:

Code: Select all

sudo watch -d -n 1 netstat -atunp

and give it your password.

[VoxelMints]

Right of course https will show as 443. I block port 80 yet this still slipped my mind. I guess having other numbers attached to 443 threw me off. I do find it odd that there isn't an equivalent utility to tcpview.

[Pippin]

Possibly Netactview:
http://ubuntuguide.net/netactview-simil ... -for-linux

But Sourceforce currently offline:
"SourceForge project websites are currently experiencing abnormally high levels of traffic. Our support staff has been notified.
Please check back in a few minutes. We thank you for your patience."

Edit:
Now reading this:
https://www.reddit.com/r/Ubuntu/comment ... ould_be_a/
I think Netactview will not work.

[VoxelMints]

I think I stumbled on Netactview at one time and came to the same conclusion that it wouldn't work in Mint. I hope someone makes a tcpview equivalent one day these kinds of utilities are important for folks coming from Windows.

I put off adopting Linux Mint for a good while because I would search and search and couldn't find a viable replacement for tcpview. Then suddenly one day I stumbled onto the lsof command and then I knew I was ready to leave my previous os.